Current status

Detailed Description

SE Linux management

FreeIPA provides means to store mapping between SE Linux contexts and users on per-host per-user basis. When user logs in into the FreeIPA-enrolled host, appropriate SE Linux context is fetched from FreeIPA server and used to set up proper security context at the host.

SSH public keys management

SSH public keys for users and hosts can be stored in FreeIPA. Upon login, keys are fetched from FreeIPA server by SSSD and cached/used for verification. HBAC rules are used to augment access on per-host per-service bases and FreeIPA tools are used to manage user's public keys.

Trust to Active Directory Domains

Currently FreeIPA uses winsync to allow users from an Active Directory domain to access resources in the IPA domain. To achieve this winsync replicates the user and group data from an Active Directory server to the local server and tries to keep them in sync.

With the new trust feature the user and group data is read from the Active Directory server as it is needed. Additionally Kerberos cross realm trust is set up which allows Single-Sign-On between the Active Directory and the IPA domain. I.e. a user from the Active Directory Domain can access kerberized resources from the IPA domain without being asked for a password.

Benefit to Fedora

Trust to Active Directory Domains will have the following benefits:

Single-Sign-On between the Active Directory and IPA domain

Allow users from the IPA domain (Linux users) to access resources from the Active Directory domain

No need to set POSIX attributes in the Active Directory domain

SSH public keys management will have the following benefits:

Centralized management of SSH host identity information

Allow IPA users to authenticate using SSH public keys in the IPA domain

Scope

Trust to Active Directory Domains requires the following changes:

FreeIPA have to be extended to store and manage the needed data to maintain the trust to the Active Directory domain and have to provide tools to set up the trust

SSSD needs to be able to query the IPA server to resolve users and groups from the Active Directory domain

Samba4 have to be updated to a recent version to allow FreeIPA to use libraries and binaries to set up and maintain the trust to an Active Directory domain

SSH public keys management requires the following changes:

FreeIPA has to allow storage of SSH public keys for users and hosts and provide tools to manage them

SSSD has to be able to acquire the keys from the IPA server and provide an interface to use them in OpenSSH

How To Test

Trust to Active Directory Domains

Detailed information about how to set up and test Trusts to Active Directory domains can be found at IPAv3 testing AD Trust

SELinux

install FreeIPA server

add a user with ipa user-add command

setup PAM and NSS to use SSSD for authentication

setup sssd to connect to the ipa server and user it as id and auth provider